District Court Enjoins Va. Attorney General From Enforcing Privacy Law Against Website Operator

The U. S. District Court for the Eastern District of Virginia (Richmond Division) has enjoined the Virginia Attorney General from enforcing certain provisions of Virginia's Personal Information Privacy Act against a plaintiff for simply republishing publicly available documents which contained individual Social Security numbers. 

[Betty] Ostergren, who is a resident of Hanover County, Virginia, advocates for privacy rights in Virginia and nationwide. (Stip. PP 2, 3). Ostergren actively has opposed the posting of land records online without first redacting the SSNs. In fact, she has lobbied the General Assembly to stop that practice. As part of her advocacy work, Ostergren established the website www.TheVirginiaWatchdog.com in 2003. (Id. P 5.) On this website, Ostergren has posted examples of public records that are available online and that contain SSNs. (Id.) The land records on the website, which contain the SSNs in question, appear along with written advocacy in support of Ostergren's views opposing the making of SSNs available online.

Ostergren's stated reason for doing so is to demonstrate graphically to members of the public that their own personal information may be available online. (Id. P 5.) As "an object lesson" and for "shock value," Ostergren decided to post mainly the SSNs reflected in the land records of "legislators and clerks [of court] because, in her view, they are principally responsible for the online availability of millions of records containing SSNs." (Id. P 12). Her website also includes public records obtained from government websites in other states and from sources other than Virginia's secure remote access system. (Id.; Hr'g Tr. at 22-28.) Ostergren has been successful in effecting change in record-keeping and SSN protection policies through her advocacy. (Hr'g Tr. at 73.)

At issue in this action is a provision of Virginia's Personal Information Privacy Act ("PIPA"), Va. Code. §§ 59.1-442 - 59.1-444. Section 59.1-443.2 provides, inter alia, that "a person shall not. . . [i]ntentionally communicate another individual's social security number to the general public." This provision took effect on July 1, 2008. Before then, the statute contained an exception for "records required by law to be open to the public." Va. Code. § 59.1-443.2(D) (2007). That exception was removed to create the current version of the statute, which Ostergren asserts to be unconstitutional as applied to her website.

Ostergren argues that her activities -- posting copies of actual public records with SSNs clearly identified -- fell within the scope of the old exception, but would now be subject to a range of civil sanctions, including fines, investigative demands, and injunctions. Va. Code Ann. § 59.1-201-59.1-206. Counsel for the Attorney-General agreed that, if Ostergren maintained her website with the posted records, she would be violating the law and be subject to those sanctions.

Ostergren represents that she obtained the unredacted public records that are posted on her website through Virginia's secure remote access system. (Dec'. of Betty J. Ostergren PP 3, 11 - 14). She argues that the State, having made these documents available to the public on the Internet through its secure remote access system, cannot now prohibit her from posting those documents on her website in furtherance of her advocacy efforts."

On August 22, 2008, the Court held that Va. Code. § 59.1-443.2 was unconstitutional as applied to Ostergren's website as it existed as of the date of the filing of this action. (See Mem. Op. at 33.) The Court simultaneously ordered Ostergren to brief the issue of the appropriate scope of the permanent remedial injunction if she was of the view that an injunction of broader reach was appropriate. (Order issued August 22, 2008 (Docket Number 25).)

Thereafter, Ostergren filed a brief  requesting that the permanent remedial injunction prohibit enforcement of Va. Code. § 59.1-443.2 against Ostergren's website for posting any public records, now or in the future. (P1. Br. at 1.) The Attorney General responded, arguing that, because of the basis for the Court's ruling, the appropriate scope of the injunction was limited to Ostergren's website as it existed when this action was filed (Def. Br. at 1.)

The parties also have filed a second stipulation of facts primarily relating to the progress made by the Virginia court clerks in redacting and removing SSNs from the records available through the secured remote access system. (Second Stip. at PP 1-5.) The second stipulation also indicates that many jurisdictions outside of Virginia continue to post available through records posted on public websites public records that contain SSNs. Additional evidence concerning Virginia's treatment of SSNs was adduced at the February 24, 2009 hearing on the issue of injunctive relief. That evidence, and its import, will be further discussed in connection with the legal issues to which it is relevant.

...

The first factor that must be demonstrated by the Plaintiff to establish the propriety of a permanent injunction is the presence of irreparable injury...The Supreme Court previously has held that the "loss of First Amendment freedoms, for even minimal periods of time, unquestionably constitutes irreparable injury." ...Indeed, in a somewhat similar case, the Fourth Circuit overturned a district court's denial of a preliminary injunction when the injury suffered by the plaintiff was the potential loss of a First Amendment right...

The application of this standard to Ostergren's case is clear. The Court already has held that Va. Code. § 59.1-443.2 infringes on Ostergren's First Amendment rights. (See Mem. Op. at 33.) Therefore, if at least some applications of the statute are not enjoined, Ostergren will suffer an irreparable injury... The precise applications of the statute that must be enjoined in order to preserve Ostergren's constitutional rights will be examined later....

The inadequacy of monetary damages as compensation for Ostegeren's loss of her First Amendment rights is similarly clear. Indeed, in cases where the damage is truly irreparable, monetary damages will seldom be an adequate remedy...Furthermore, monetary damages are typically regarded as inadequate where the injury is continuous or repeated... Finally, damages are rendered inadequate as a remedy when actual damages would be difficult to ascertain....

All of these factors weigh in favor of Ostergren. The threat to Ostergren's constitutional rights would be a continuing danger if the application of the statute against her website is not enjoined.... Furthermore, the actual damages suffered by Ostergren would be essentially impossible to ascertain - Ostergren's website is a not-for-profit enterprise, and thus has no future earnings to lose, and the price tag on First Amendment rights is certainly difficult to establish. Finally, the harm suffered by Ostergren - the violation of her First Amendment rights - is essentially irreparable. Therefore, Ostergren's remedies are inadequate at law....

The third factor to be considered in deciding on the propriety of a permanent injunction is whether "considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted." ... The Fourth Circuit has explained that a government "is in no way harmed" by the issuance of an injunction prohibiting it from enforcing an unconstitutional law. ... Indeed, if anything, in that circumstance the state's system would be improved by issuance of an injunction. ...Therefore, any harm done to the State caused by enjoining unconstitutional applications of Va. Code. § 59.1-443.2 is minimal, at best.

Balanced against this minimal or nonexistent harm is the significant injury done to Ostergren by allowing enforcement of Va. Code. § 59.1-443.2 against her website. Much like the plaintiff in Carandola, Ostergren faces substantial fines and other stiff civil penalties if the statute were enforced against her. ... In addition to these concrete sanctions, Ostergren will also suffer the serious harm of the deprivation of a Constitutional right. Therefore, the balance of harms weighs heavily in Ostergren's favor, supporting the issuance of a permanent injunction.

...

The final factor that must be considered in determining the propriety of a permanent injunction is whether such an injunction would be in the public interest. ...The Fourth Circuit is unequivocal that "upholding constitutional rights serves the public interest." ... It is true that the public certainly has an interest in being subject to the reduced likelihood of falling prey to the scourge of identity theft. However, "the public interest is better served by following binding Supreme Court precedent and protecting [] core First Amendment right[s]." ... And, as discussed below, it is possible to frame an injunction that will accommodate both aspects of the public interest. Therefore, all four necessary factors weigh in favor of granting a permanent injunction that restrains the State from unconstitutional applications of Va. Code. § 59.1-443.2.

...

Having determined that a permanent injunction is an appropriate remedy, it is necessary now to decide the appropriate scope of that injunction. As a general proposition, the scope of an injunction remedying a constitutional harm should be limited to "enjoin only the unconstitutional applications of a statute while leaving other applications in force."...Accordingly, partial, not total, invalidation of a statute is the more usual scope of injunctive relief upon a finding of unconstitutionality....

However, courts also must be careful not to intrude on the legislative domain by rewriting the statute. ...To preserve legislative intent in the face of an unconstitutional statute or application thereof, courts "must next ask: Would the legislature have preferred what is left of its statute to no statute at all?"...These principles inform the resolution of the issue now presented for decision: the scope of the permanent remedial injunction.

...

The first step in determining the appropriate scope of the remedy in Ostergren's case is to determine the exact scope of the constitutional right placed at hazard by the statute.

...

Therefore, in order to determine whether enforcement of Va. Code. § 59.1-443.2 against future publications of public records on Ostergren's website would violate her First Amendment rights, it is necessary to determine whether all four elements would be present at the time of those future postings. For the reasons discussed earlier, Ostergren's website will be regarded as the equivalent of "a newspaper" for purposes of the Florida Star analysis. (Mem. Op. at 23-24.) This status will not change with future postings of public records because Ostergren will still be "analytically indistinguishable from a newspaper" in that she will continue to provide information and opinion to the public about matters of public concern. (Id. at 23 (quoting Sheehan v. Gregoire, 272 F. Supp. 2d 1135, 1145 (W.D. Wash. 2003).)

...

Ostergren testified the SSNs which appear on her website are imbedded in the public records which she has obtained online. She intends to continue to publish records thusly obtained. (Hr'g Tr. at 24-33.) The parties have stipulated that, even after the redaction efforts have been completed, there will still be some publicly available documents on the secured access network and elsewhere with unredacted SSNs, because the redaction process has a one to five percent failure rate. (See Second Stip. at PP 4, 5., 6) It is, by definition, legal to obtain publicly available information. See Florida Star, 491 U.S. at 534. Therefore, the second element of the Florida Star analysis will remain unchanged, as well, because Ostergren will still be publishing lawfully-obtained, truthful information. See id.

The resolution of the third element of the Florida Star test is similarly clear. See 491 U.S. at 534. There is no indication that the need to prevent the release of SSNs to the public, and the related issue of the State's efforts achieve that goal, will cease to be a matter of public concern. (See Mem. Op. at 28.) Criminal activity, such as identity fraud, and information concerning that activity are archetypical matters of public concern. ... Furthermore, the parties have agreed that identity theft, the criminal phenomenon that creates the necessity to prevent dissemination of SSNs, will continue to be a matter of public concern. (See Pl. Br. at 3-4; Def. Br. at 4.) Virginia's publication of SSNs on what is a fundamentally unsecure network substantially increases the ability of individuals to commit the crime of identity fraud, and will continue to do so in the future, if the SSNs are not removed. Therefore, there is no cognizable difference between those records posted on Ostergren's website when this case was filed and the public records that would putatively be posted in the future.

The record indicates, and the parties tacitly agree, that the element of the most analytical moment is whether the State has indicated sufficiently that, going forward, it intends to treat the prevention of SSN dissemination as "a state interest of the highest order." (See Mem. Op. at 26, 31; P1 Br. at 2-3; Def. Br. at 4.) The important issue for purposes of the crafting the scope of the permanent injunction, therefore, is to determine whether the State's recent efforts have been sufficient to indicate that the State now (i.e., after Ostergren's filing of this action) treats such information as a state interest of the highest order. See Florida Star, 491 U.S. at 534.

Whether the State has an interest of the highest order is answered by examining objectively the means by which the State treats the information in question. See id. at 537. The relevant case law is clear that, if the State wishes to claim that the confidentiality of a certain piece of information is a State interest of the highest order, then the State should not make that information publicly available. See id. at 534-5. As the Supreme Court explained in Florida Star

Where information is entrusted to the government, a less drastic means than punishing truthful publication almost always exists for guarding against the dissemination of private facts . . . [W]here the government has made certain information publicly available, it is highly anomalous to sanction persons other than the source of its release.

Id. Subsequent cases comport with this assessment....

The basic outline of the State's plan to maintain the confidentiality of SSNs is as follows: all clerks of court are required to have redacted the SSNs from their records by the end of 2010, if funding for the project is allocated by the General Assembly (Hr'g Tr. at 79); the redaction process used on both preexisting and newly-published records is being completed either by the clerks themselves or through contract work with outside companies (Second Stip. at P 1); the redaction process has an average failure rate of one-to-five percent (Id. at P 5); and, the General Assembly has appropriated approximately $ 7 million to fund the redaction, but this amount is insufficient to fully fund the project (Hr'g Tr. at 79).

The redaction process started in 2007 will not be complete for all jurisdictions until, optimistically, July, 2010. (See id. at P 2.) Approximately 105 of 120 jurisdictions have completed the redaction process, but among the 15 jurisdictions that have not completed the process are some of the State's most populous areas. (Id. at PP 1-2.) The more-likely completion date, as identified at oral argument, is the end of 2010, and the redaction may not even be finished at that point because of funding problems. (Hr'g Tr. at 77.) The State has furnished no justification for why the land records of clerks that have not completed redaction have not simply been removed from the internet until the redaction is complete. The necessary inference drawn from the choices of the General Assembly in enacting the statutes that require clerks of court to make land records online, in providing limited funding for redaction of SSNs, and in failing to direct, even after this litigation, that the records be removed from the internet until redaction is complete, is that the State is of the view that having the documents available on the internet is of greater importance to the State than protecting confidentiality of the SSNs in those records.

Furthermore, the parties have stipulated that the redaction process will not be successful at removing all SSNs from the secured access network. (Second Stip. at P 5.) Thus, the redaction process, even after completion, will leave over 60,000 SSNs available for public view on the network. (See Hr'g Tr. at 48-49.)

The State explains that, after the redaction process is complete, it will handle the one to five percent failure rate by removing SSNs from the network once the relevant clerk is alerted to their presence. (See Second Stip. at P 5.) That approach does not obviate the fact that, even after the envisioned redaction process is completed, there will remain some 60,000 SSNs available on the Internet. The bell cannot be unrung: once the information has been released, it has been released, and it cannot be called back and retroactively made secret....

A subsidiary issue that has not been discussed to this point is, even if a State interest of the highest order is assumed to exist, whether the statute codifying that interest has been narrowly tailored to further that interest....The Third Circuit has held that, "when the government has stewardship over confidential information, not releasing the information to the media in the first place will more narrowly serve the interest of preserving confidentiality than will punishing the publication of the information once inappropriately released."... This reasoning applies with equal force here: the most narrowly tailored solution to the problem of dissemination of SSNs over which the State has custody is not to release those SSNs into the public domain. Thus, as applied to Ostergren's website as it will exist in the future, Va. Code. § 59.1-443.2 is not narrowly tailored.

...

Without doubt, Va. Code § 59.1-443.2 violates Ostergren's rights under the First Amendment. The decisions of the Supreme Court making that clear, however, speak in broad terms, and, in each case, the Supreme Court has taken pains to confine its decisions to the facts presented by each particular case. See, e.g., Florida Star, 491 U.S. at 537-38, 541. Furthermore, the Supreme Court has been clear that, fundamentally, the analysis of the First Amendment rights at issue requires striking the appropriate balance between the competing interests of the individual rights of the publisher and the protection of the citizens to whom the released information pertains. See id.; see also Daily Mail, 443 U.S. at 104-05. In none of the decisions defining the contours of the First Amendment right at issue here did the Supreme Court confront a situation in which the published information, albeit obtained from publicly available sources, could result in the financial ruin of thousands of innocent members of the public.

Indeed, it is not overstating the matter to observe that the lives of victims of identity theft are severely altered for years after the theft occurs. See Chris Jay Hoofnagle, Identity Theft: Making the Known Unknowns Known, 21 HARV. J. L. & TECH. 97, 98-99 (2007). It is beyond question that access to a person's SSN provides an identity thief with the key element to effectuate particularly ruinous types of identity theft. See id. at 100-101. "An identity thief [armed with the victim's SSN] can empty bank accounts, obtain credit cards, secure loans, open lines of credit, connect telephone services, and enroll in government benefits in a victim's name." Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age, 80 S.CAL. L. REV. 241, 253 (2007). The average victim of identity theft suffers a loss of approximately $ 17,000, and will spend more than $ 1,000 and 600 hours of personal time dealing with the consequences of his victimization. See id. at 254. Identity thieves are only rarely caught and punished for their crimes. See Hoofnagle, supra, at 108 (identity thieves "have a one out of 700 chance of getting caught by federal authorities.").

...

The enactment of Va. Code § 59.1-443.2 certainly is a significant step toward demonstrating the order of the State's interest. However, the State ignored rather obvious alternative solutions (e.g., prohibiting inclusion of SSNs in documents to be filed in public records, requiring or funding complete redaction, and removing the records from interest access until redaction is complete) that are less drastic than punishing someone who republishes that which is in the public records; punishment that is in contravention of rather clear Supreme Court precedent. (See Mem. Op. at 24.)

To implement those alternatives by judicial order would constitute impermissible legislation by the judiciary....Furthermore, given the text of the statute, a limiting construction of the statute itself does not present itself.

It is, however, conceptually possible to frame a remedial injunction that does not legislate, but that does accommodate the First Amendment rights of Ostergren and, at the same time, affords some protection to the innocent members of the public who have no control of the release of the public records containing their SSNs. Given the case-by-case approach to issues of this sort counseled by the Supreme Court in Cox, Daily Mail and Florida Star, that balance might be best effectuated by enjoining enforcement of the statute to allow Ostergren to use the SSN-containing public records of legislators, executives, and court clerks, which will allow her to pursue what she considers to be effective lobbying activity while minimizing the exposure of members of the public who have no way to prohibit the dissemination of the records containing their SSNs. Indeed, such an injunction largely only ratifies Ostergren's current course of conduct and, as she herself stated, would not have a seriously deleterious effect on her public advocacy. (Hr'g Tr. at 36-37.)

That course does afford less generous protection to Ostergren's rights under the First Amendment than was made available to a publishing entity under Cox, Daily Mail or Florida Star. However, as noted above, in none of those cases was the Supreme Court confronted with the particularly ruinous consequences  that predictably ensue from the wholesale release of SSNs on Ostergren's website or on other sites that choose not to exercise the commendable restraint shown thus far by Ostergren. This application of the law adheres to the analytical method set forth in Cox, Daily Mail and Florida Star, despite the fact that it results in a remedy of slightly less expansive scope - a result clearly contemplated by the Supreme Court in those cases.

...
Under all the circumstances, the public interests in free speech and public security are best balanced by entry of a narrowly tailored injunction that allows Ostergren to publish the SSN-containing records of State legislators, State Executive Officers and Clerks of Court, those who actually can act to correct the problem, but that forecloses wholesale publication of the SSN-containing records of innocent members of the public who did nothing to cause the problem  and who can do nothing to change the law or appropriate or expend funds to address the problem.

For the foregoing reasons, a permanent injunction will be entered against enforcement of Va. Code. § 59.1-443.2 against any iteration of Ostergren's website, now or in the future, that simply republishes publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia Executive Officers or Clerks of Court as part as an effort to reform Virginia law and practice respecting the publication of SSNs online.

The case is Ostergren v. McDonnell, 2009 U.S. Dist. LEXIS 46039.